fix(sandbox): pre-validate agent passthrough selector and phase - #5671
Merged
jyaunches merged 11 commits intoJun 25, 2026
Conversation
Signed-off-by: Tinson Lai <tinsonl@nvidia.com>
Contributor
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
📝 WalkthroughWalkthroughAdds two host-side validation guards to ChangesAgent Passthrough Host-Side Validation
Estimated code review effort🎯 2 (Simple) | ⏱️ ~12 minutes Possibly related issues
Poem
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
Contributor
|
🌿 Preview your docs: https://nvidia-preview-pr-5671.docs.buildwithfern.com/nemoclaw |
Contributor
Code Coverage OverviewLanguages: TypeScript TypeScript / code-coverage/pluginThe overall coverage in the Show a code coverage summary of the most covered files.
TypeScript / code-coverage/cliThe overall coverage in the Show a code coverage summary of the most covered files.
Updated |
laitingsheng
added
integration: openclaw
Contributor
PR Review Advisor — No blocking findingsMerge posture: No blocking advisor findings Action checklist
Test follow-ups to resolve or justifyIf these cover changed behavior, prefer adding them in this PR; otherwise state why existing coverage is enough or link the follow-up.
This is an automated, non-binding review; it still expects maintainers and agents to respond to each required or warning item. Treat suggestions as current-PR improvements when they touch changed code; defer only with maintainer rationale or a linked follow-up. A human maintainer must make the final merge decision. |
Contributor
E2E Advisor RecommendationRequired E2E: Dispatch hint: Full advisor summaryE2E Recommendation AdvisorBase: Required E2E
Optional E2E
New E2E recommendations
Dispatch hint
|
Contributor
Vitest E2E Scenario RecommendationRequired Vitest E2E scenarios: None Full Vitest E2E advisor summaryVitest E2E Scenario AdvisorBase: Required Vitest E2E scenarios
Optional Vitest E2E scenarios
Relevant changed files
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
🧹 Nitpick comments (1)
docs/reference/commands.mdx (1)
567-567: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winSplit this bullet into one sentence per line and remove the double em-dash pattern (LLM pattern detected).
Line 567 currently has two sentences on the same source line and uses two em dashes in one sentence.
As per path instructions, “One sentence per line in source (makes diffs readable)” and “Excessive em dashes... should be flagged.”🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/reference/commands.mdx` at line 567, The bullet point on line 567 in docs/reference/commands.mdx contains two sentences on a single line and uses a double em-dash pattern (em-dash before and after a phrase). Split this into two separate lines with one sentence per line and replace the double em-dash pattern with standard punctuation or restructure the sentence to avoid the double em-dash (which is detected as an LLM pattern). The first sentence should cover the target selector flags and their format, and the second sentence should cover the behavior of invocations without a selector.Source: Path instructions
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In `@docs/reference/commands.mdx`:
- Line 567: The bullet point on line 567 in docs/reference/commands.mdx contains
two sentences on a single line and uses a double em-dash pattern (em-dash before
and after a phrase). Split this into two separate lines with one sentence per
line and replace the double em-dash pattern with standard punctuation or
restructure the sentence to avoid the double em-dash (which is detected as an
LLM pattern). The first sentence should cover the target selector flags and
their format, and the second sentence should cover the behavior of invocations
without a selector.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: eb30afe6-2e0d-4e6f-8e2e-18d4fce68e0a
📒 Files selected for processing (3)
docs/reference/commands.mdxsrc/lib/actions/sandbox/agent/passthrough.test.tssrc/lib/actions/sandbox/agent/passthrough.ts
Signed-off-by: Tinson Lai <tinsonl@nvidia.com>
…equire selector Signed-off-by: Tinson Lai <tinsonl@nvidia.com>
Contributor
There was a problem hiding this comment.
🧹 Nitpick comments (1)
src/lib/actions/sandbox/agent/passthrough-help.ts (1)
26-33: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winConsider keeping the error message on a single line for clarity.
The backtick-quoted error message
"No target session selected"is split across two console.log calls (lines 30-32), which makes it harder to read in the printed output. Consider restructuring to keep the complete message on one line.📝 Proposed fix to improve readability
console.log( " Every invocation must include exactly one target selector — --agent, --session-id,", ); console.log( - " --session-key, or --to. Invocations without a selector exit 2 with `No target session", + " --session-key, or --to. Invocations without a selector exit 2 with", ); - console.log(" selected` before any in-sandbox dispatch runs."); + console.log( + " `No target session selected` before any in-sandbox dispatch runs.", + ); console.log("");🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@src/lib/actions/sandbox/agent/passthrough-help.ts` around lines 26 - 33, The error message "No target session selected" is currently split across two separate console.log statements (one ending with "No target session" and the next starting with "selected"), which breaks readability in the printed output. Consolidate the two console.log calls on lines 31 and 33 into a single console.log statement that keeps the complete quoted message "No target session selected" together on one line while maintaining the descriptive context around it.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In `@src/lib/actions/sandbox/agent/passthrough-help.ts`:
- Around line 26-33: The error message "No target session selected" is currently
split across two separate console.log statements (one ending with "No target
session" and the next starting with "selected"), which breaks readability in the
printed output. Consolidate the two console.log calls on lines 31 and 33 into a
single console.log statement that keeps the complete quoted message "No target
session selected" together on one line while maintaining the descriptive context
around it.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 00795fa4-cfd8-4f35-8d61-1cc66fdebda0
📒 Files selected for processing (5)
docs/reference/commands.mdxsrc/commands/sandbox/agent.tssrc/lib/actions/sandbox/agent/passthrough-help.tssrc/lib/actions/sandbox/agent/passthrough.test.tssrc/lib/actions/sandbox/agent/passthrough.ts
✅ Files skipped from review due to trivial changes (1)
- src/commands/sandbox/agent.ts
🚧 Files skipped from review as they are similar to previous changes (3)
- docs/reference/commands.mdx
- src/lib/actions/sandbox/agent/passthrough.ts
- src/lib/actions/sandbox/agent/passthrough.test.ts
Signed-off-by: Tinson Lai <tinsonl@nvidia.com>
Signed-off-by: Tinson Lai <tinsonl@nvidia.com>
Contributor
There was a problem hiding this comment.
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
src/lib/actions/sandbox/agent/passthrough-help.ts (1)
27-32: 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick winClarify selector exit-code wording for non-Ready sandboxes
This text implies missing selector always exits 2, but runtime checks phase first and exits 1 on non-Ready/Running states. Please scope the sentence so it matches actual behavior (e.g., “on Ready/Running sandboxes”).
Suggested wording
- " --session-key, or --to. Invocations without a selector exit 2 with `No target session", + " --session-key, or --to. On Ready/Running sandboxes, invocations without a selector exit 2 with `No target session",🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@src/lib/actions/sandbox/agent/passthrough-help.ts` around lines 27 - 32, The console.log statements describing the selector validation behavior (lines 27-32) incorrectly imply that missing selectors always exit with code 2, but this only occurs on Ready/Running sandboxes since runtime checks happen first and exit with code 1 for non-Ready states. Update the help text in these console.log calls to clarify that the exit code 2 behavior with "No target session selected" only applies when the sandbox is in a Ready or Running state, to match the actual runtime behavior.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Outside diff comments:
In `@src/lib/actions/sandbox/agent/passthrough-help.ts`:
- Around line 27-32: The console.log statements describing the selector
validation behavior (lines 27-32) incorrectly imply that missing selectors
always exit with code 2, but this only occurs on Ready/Running sandboxes since
runtime checks happen first and exit with code 1 for non-Ready states. Update
the help text in these console.log calls to clarify that the exit code 2
behavior with "No target session selected" only applies when the sandbox is in a
Ready or Running state, to match the actual runtime behavior.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 0be6a9c3-d8e2-4fad-8753-6d25ff6001d5
📒 Files selected for processing (3)
docs/reference/commands.mdxsrc/lib/actions/sandbox/agent/passthrough-help.tssrc/lib/actions/sandbox/agent/passthrough.test.ts
🚧 Files skipped from review as they are similar to previous changes (2)
- docs/reference/commands.mdx
- src/lib/actions/sandbox/agent/passthrough.test.ts
…in boundary comment Signed-off-by: Tinson Lai <tinsonl@nvidia.com>
…tes phase precedence Signed-off-by: Tinson Lai <tinsonl@nvidia.com>
…ream argv boundary Signed-off-by: Tinson Lai <tinsonl@nvidia.com>
…f silent passthrough Signed-off-by: Tinson Lai <tinsonl@nvidia.com>
…ot tolerant path Signed-off-by: Tinson Lai <tinsonl@nvidia.com>
prekshivyas
approved these changes
Jun 25, 2026
prekshivyas
left a comment
prekshivyas
left a comment
Collaborator
There was a problem hiding this comment.
CI green, parseSandboxPhase confirmed pre-existing on main at state/gateway.ts:189. Phase-before-selector ordering is correct and tested with the literal #5655 agent -m ping reproducer. -- boundary handling is correct and tested. Fail-closed on unparseable phase is the right defensive choice. Docs and examples updated consistently.
21 tasks
Hadar301
pushed a commit
to Hadar301/NemoClaw-OpenShift
that referenced
this pull request
Jul 12, 2026
…IA#5671) ## Summary `nemoclaw <name> agent` deferred selector and phase validation to upstream OpenClaw and to `openshell sandbox exec`. Upstream OpenClaw exits `0` on its "No target session selected" path, so the wrapper inherited the wrong exit code; the phase rejection from openshell lacked the documented NemoClaw recovery commands. Both are now pre-validated host-side in the agent passthrough. ## Related Issue Fixes NVIDIA#5653 Fixes NVIDIA#5655 ## Changes - `src/lib/actions/sandbox/agent/passthrough.ts`: reject with exit `2` and `No target session selected` when none of `--agent`, `--session-id`, `--session-key`, `--to` (bare or `--flag=value`) is present in `extraArgs`; reject with exit `1` and recovery hints (`recover`, `rebuild --yes`, `onboard --resume`) when the resolved sandbox phase is neither `Ready` nor `Running`. - `src/lib/actions/sandbox/agent/passthrough.test.ts`: cover both new guards (no-selector, empty extraArgs, `--flag=value` form, non-Ready phase, no-phase-output passthrough); update prior selector-less tests to include a selector. - `docs/reference/commands.mdx`: document the host-side validation block under `$$nemoclaw <name> agent`. ## Type of Change - [x] Code change (feature, bug fix, or refactor) - [x] Code change with doc updates - [ ] Doc only (prose changes, no code sample modifications) - [ ] Doc only (includes code sample changes) ## Verification - [x] PR description includes the DCO sign-off declaration and every commit appears as `Verified` in GitHub - [x] Git hooks passed during commit and push, or `npx prek run --from-ref main --to-ref HEAD` passes - [x] Targeted tests pass for changed behavior - [ ] Full `npm test` passes (broad runtime changes only) - [x] Tests added or updated for new or changed behavior - [x] No secrets, API keys, or credentials committed - [x] Docs updated for user-facing behavior changes - [ ] `npm run docs` builds without warnings (doc changes only) - [ ] Doc pages follow the [style guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md) (doc changes only) - [ ] New doc pages include SPDX header and frontmatter (new pages only) --- Signed-off-by: Tinson Lai <tinsonl@nvidia.com> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Improvements** * Updated `sandbox agent` passthrough to require at least one target selector flag (`--agent`, `--session-id`, `--session-key`, or `--to`); missing selectors exit with code `2` with “No target session selected”. * Added sandbox phase gating: if the sandbox isn’t `Ready`/`Running`, it exits with code `1` and prints recovery guidance (`recover`, `rebuild --yes`, `onboard --resume`). * **Tests** * Expanded passthrough tests for selector validation (including `--flag=value` forwarding) and phase-dependent exit behavior. * **Documentation** * Refreshed `sandbox agent` help and reference examples to emphasize selector-based usage and supported flag formats. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Signed-off-by: Tinson Lai <tinsonl@nvidia.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
nemoclaw <name> agentdeferred selector and phase validation to upstream OpenClaw and toopenshell sandbox exec. Upstream OpenClaw exits0on its "No target session selected" path, so the wrapper inherited the wrong exit code; the phase rejection from openshell lacked the documented NemoClaw recovery commands. Both are now pre-validated host-side in the agent passthrough.Related Issue
Fixes #5653
Fixes #5655
Changes
src/lib/actions/sandbox/agent/passthrough.ts: reject with exit2andNo target session selectedwhen none of--agent,--session-id,--session-key,--to(bare or--flag=value) is present inextraArgs; reject with exit1and recovery hints (recover,rebuild --yes,onboard --resume) when the resolved sandbox phase is neitherReadynorRunning.src/lib/actions/sandbox/agent/passthrough.test.ts: cover both new guards (no-selector, empty extraArgs,--flag=valueform, non-Ready phase, no-phase-output passthrough); update prior selector-less tests to include a selector.docs/reference/commands.mdx: document the host-side validation block under$$nemoclaw <name> agent.Type of Change
Verification
Verifiedin GitHubnpx prek run --from-ref main --to-ref HEADpassesnpm testpasses (broad runtime changes only)npm run docsbuilds without warnings (doc changes only)Signed-off-by: Tinson Lai tinsonl@nvidia.com
Summary by CodeRabbit
sandbox agentpassthrough to require at least one target selector flag (--agent,--session-id,--session-key, or--to); missing selectors exit with code2with “No target session selected”.Ready/Running, it exits with code1and prints recovery guidance (recover,rebuild --yes,onboard --resume).--flag=valueforwarding) and phase-dependent exit behavior.sandbox agenthelp and reference examples to emphasize selector-based usage and supported flag formats.